Add-in Express file blocked by Microsoft Defender when starting Outlook

Add-in Express™ Support Service
That's what is more important than anything else

Add-in Express file blocked by Microsoft Defender when starting Outlook
Microsoft Defender warns about blocking IntResource64.dll when ASR rules are all turned on 
Bart Vadala




Posts: 9
 Joined: 2015-09-21
We have received reports from some of our clients who has https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference ASR rule turned on to see the following warning from Microsoft Defender when starting Outlook: 

Risky action blocked
21/10/2022 12:31 PM

Your administrator has blocked this action.

App or process blocked: OUTLOOK.EXE

Blocked by: Attack surface reduction
Rule: Block executable content from email client and webmail

Affected items: C:\Users\User\AppData\Local\Temp\IntResource64.dll


It seems the file 
IntResource64.dll
is from Add-in Express.

I'd like to know what impact this may cause and if there's any way to avoid this warning without negotiating with the client's IT to turn off the ASR rule.
Posted 21 Oct, 2022 00:09:26 Top
Andrei Smolin


Add-in Express team


Posts: 18821
 Joined: 2006-05-11
Hello Bart,

You can try to deploy IntResource64.dll and IntResource.dll along with other files of your add-in. Or, they can exclude these files; see https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide#exclude-files-and-folders-from-asr-rules.

Regards from Poland (CEST),

Andrei Smolin
Add-in Express Team Leader
Posted 21 Oct, 2022 04:20:24 Top